Extracted

• • Target

    0c8c53fc87610174bd8d304940ed84dd.exe

  • Size

    2.6MB

  • MD5

    0c8c53fc87610174bd8d304940ed84dd

  • SHA1

    e049d2b70beec23414f252d3aab26f179e1573bc

  • SHA256

    eee98aabaf632f6d85b08f40401058696980c57a60bbf57ffae069e6ee1b827c

  • SHA512

    7150b0f65b6bb01d8be8d36a49c08239950384aa4382bda387b8de733f3f4f0db9eabf148e85b9b11efaf60761be703a6c28fdfdc6df87b03db6fb96acc4380e

  • SSDEEP

    49152:b+PPOOZeF0a/ICoVrIdEXZe1pVhZ88hfOKx/13ZvTIqab7SNudXjdTF:HOk0axoVrIuXytKtKTrROJF

  Score

  10^/10

  quasarbilddiscoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2